A company is planning to migrate from an on-premises Active Directory to a cloud-only identity model using Azure AD. They currently use the Control Hub directory connector to sync users. They want to transition to SCIM provisioning from Azure AD without causing user disruption. What is the recommended migration approach?

Keep the directory connector running during the transition to ensure no users are lost.

Disable the directory connector, enable SCIM from Azure AD, and run a full sync to update existing users.

Delete all users in Control Hub and let SCIM recreate them.

Use CSV import to merge users from the directory connector with Azure AD.

Which of the following is a best practice for managing cloud users in Control Hub?

Creating individual user accounts manually for each employee

Disabling SCIM after initial user creation to avoid ongoing changes

Using SCIM or the directory connector to automate user provisioning

Assigning all users the same role for simplicity

Which of the following is required to complete SCIM integration between an identity provider and Control Hub?

A shared secret configured in both systems

The IP address of the Control Hub data center

A VPN connection between the identity provider and Control Hub

The SCIM API endpoint URL and a bearer token

A company wants to ensure that user accounts in Control Hub are automatically deactivated when employees leave the organization. They have an on-premises Active Directory and want to use the directory connector. What is the best way to achieve this?

Use a custom role to deactivate users automatically.

Configure the directory connector to sync user status, so when an account is disabled in Active Directory, it is deactivated in Control Hub.

Manually deactivate users in Control Hub when they leave.

Use SCIM provisioning from Azure AD instead of the directory connector.

What is the primary purpose of role-based access control (RBAC) in Control Hub?

To provide single sign-on capabilities for users

To synchronize user accounts from external directories

To encrypt user data stored in Control Hub

To restrict user access to specific features based on their role

CiscoCertified Network Professional Collaboration

Domain 5Objective 8

5.8 Configure Cloud User Management (Control Hub Directory Connector, SCIM, and RBAC) 350-801 Practice Questions (Page 2)

Part of the Cloud and Hybrid Services domain, which accounts for 25% of the 350-801 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

25%of the exam

Questions 6–10

6expert · hard
A company is planning to migrate from an on-premises Active Directory to a cloud-only identity model using Azure AD. They currently use the Control Hub directory connector to sync users. They want to transition to SCIM provisioning from Azure AD without causing user disruption. What is the recommended migration approach?
Select an answer first
7foundation · easy
Which of the following is a best practice for managing cloud users in Control Hub?
Select an answer first
8foundation · easy
Which of the following is required to complete SCIM integration between an identity provider and Control Hub?
Select an answer first
9application · medium
A company wants to ensure that user accounts in Control Hub are automatically deactivated when employees leave the organization. They have an on-premises Active Directory and want to use the directory connector. What is the best way to achieve this?
Select an answer first
10foundation · easy
What is the primary purpose of role-based access control (RBAC) in Control Hub?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-801

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-801” is a trademark of its owner, used for identification only.